The portfolio, governed.

1. 01Define / Classify

   Establish the outcome, use-case class, data boundary, risk posture, and authority model.

2. 02Decompose / Plan

   Convert the accepted outcome into owned, testable work with explicit dependencies and completion criteria.

3. 03Architect / Secure

   Set the service, data, integration, identity, threat, and human-oversight design before implementation.

4. 04Build / Integrate

   Create and integrate the change inside the approved design and controlled workspace boundary.

5. 05Validate / Test

   Demonstrate functional, security, privacy, accessibility, integration, and AI-specific behavior against the plan.

6. 06Package Evidence

   Assemble a reviewable record that connects requirements, changes, tests, controls, approvals, gaps, and rollback.

7. 07Release / Operate

   Make and execute the release decision, then operate with telemetry, support, rollback, and change control.

Thirteen security and compliance control gates bind the delivery path — a layer across the lifecycle, never an eighth phase.

Observability gives you visibility. A control plane gives you authority.

• Zero-trust independence. No agent verifies its own output — a verifier is a different model lineage or a deterministic tool.
• Named human release authority. Release decisions close at a named human; a failed gate creates remediation work, never a transfer of accountability to an agent.

In PMI terms the seven phases operate as stage gates; in Agile terms they are the definition-of-done ladder. Per-initiative phase and gate mapping arrives through the governed update path.

The full AI delivery system The AI SDLC deep dive, presented The verification control plane whitepaper